HLS behind a CDN: cache rules, LL-HLS and private streams
HLS scales through a CDN because it is ordinary HTTP: cache each media segment for a long time, cache each live playlist for about a second, and let LL-HLS's blocking requests pass through to the origin. The catch is access control: a cache hit never reaches your server, so streams that need permission per viewer must be protected at the CDN itself.
What to cache, and for how long
| Request | Cache-Control |
|---|---|
Live playlist (.m3u8) |
public, max-age=1, s-maxage=1 |
Playlist request with _HLS_msn, _HLS_part or
_HLS_skip
|
Bypass the cache |
Media segment or part (.ts, .m4s, .mp4)
|
public, max-age=31536000, immutable |
| Redirect, denied or missing file | Not cached |
Segments are safe to cache for a year only if their names are never reused. Names that include a session prefix guarantee that.
LL-HLS through a CDN
An LL-HLS player asks for the playlist with _HLS_msn and
_HLS_part, meaning: answer when this part exists. The origin holds the
request open until then. If a CDN caches or coalesces those requests incorrectly, players
get stale playlists and fall behind. Add a rule that sends any request carrying those
query parameters to the origin; parts and segments themselves still cache normally.
Private streams
An origin can check passwords, IP rules, expiry and revocation on every request, but a CDN cache hit never asks the origin. For streams that need per-viewer permission, either:
- verify signed URLs or signed cookies at the CDN on every playlist, part and segment request, including cache hits, and only allow the CDN to reach the origin; or
- keep the token in the cache key and forwarded to the origin, accepting one cache entry per token.
Never strip a token from the cache key to raise the hit rate: that serves one viewer's response to everyone.
Checking it works
- Publish a test stream and request the same completed segment twice: the second should be a cache HIT.
- Confirm playlists stay fresh and parts arrive on time in a real player.
- Try a denied or expired signature and confirm it fails at the edge.
In creekX: HLS is private and uncached by default. The installer writes an explicit shared-cache policy you switch on once access is enforced at the CDN or the streams are public; step-by-step setup for Cloudflare and CloudFront is in HLS through a CDN.
Frequently asked questions
Can WebRTC go through a CDN?
Not through an ordinary HTTP CDN. Scale WebRTC with edge servers that relay the stream; scale HLS with a CDN.
How long should a CDN cache an HLS playlist?
About one second for a live playlist, so viewers never see a stale one. Media segments never change once written and can be cached for a year.
Can I remove the token from the cache key to get more hits?
No. If the token is not part of the cache key, one viewer’s cached response is served to others without their token being checked.